To make this comparison we used feedback from our customers and partners who installed each solution and used them for 2+ weeks to evaluate each M365 backup option.
Afi.ai itself develops a Microsoft (Office) 365 backup platform (see the product page if you're interested). We attempt to remain as impartial and objective as possible, and we hope that you will find this review useful when evaluating your options (in the absence of Microsoft 365 backup bencmarking analysis published by independent analysts).
Why O365 Backups Are Imperfect
Microsoft 365 consists of multiple interconnected applications and distinct data types. Backup applications pull this data from O365 using Microsoft APIs.
Importantly, Microsoft does not provide a single unified API to access all M365 applications & data. Backup vendors have to rely on a combination of multiple new and legacy APIs to backup and restore the Office 365 data that it accessible (and ignore the data that is inaccessible via the APIs).
Because of frequent M365 updates, it is time-consuming and expensive to support every data type. M365 cloud backup vendors instead focus on a subset of Microsoft 365 applications that they consider to be the most relevant. These priorities differ from vendor to vendor, and the quality of the implementation differs as well.
No vendor backs up all O365 data due to API limitations; backup accuracy & restore fidelity differ greatly across vendors
The quality and completeness of O365 backup therefore varies greatly among vendors mostly because:
- Tech legacy & historical reasons resulted in not just one single API for Microsoft 365, but a combination of a few
- Existing APIs are limited and some M365 applications have no dedicated APIs (e.g. Teams that have to be backed up "indirectly" can can't be restored)
- Frequent updates to M365 mean that new data types are constantly being added; M365 backup vendors need to make additional effort to support them
We assign a Backup Fidelity score for each vendor in this review to assess how accurately their tool backs up O365 data, and how many O365 data types it supports. In addition to O365 Backup Fidelity we include 9 other metrics (see the next section) which together assess the most relevant capabilities of MS Office backup tools.
O365 Backup Features Checklist
Most tools provide the same basic O365 backup features that include support of Exchange, OneDrive & SharePoint data types, automated (scheduled) backup runs, and the ability to export/restore data back to O365 user accounts.
Where the solutions differ greatly is the accuracy of the O365 data backup, the granularity of their restore options and the reliability. We analyzed 10 critical capabilities summarized below.
Critical Microsoft 365 backup features include 10 capabilities that reflect solutions' reliability, security, feature set and cost
Extent of Office applications support and their data types. Ability to recover data accurately.
- complete support of the main apps (e.g. exchange online archive, public folders, legacy SharePoint webpages)
- new data types - e.g. team (private) channels, chats, etc
Ability to mass-manage backups and the granularity of auto-protection settings.
- 3x or higher daily backup frequency
- protection assignment based on user Group membership
- granular auto-protection (by resource type/user group)
Ability to navigate and preview backup data before restore, backup search speed & scope.
- point-in-time backup navigation
- online data preview (for email, other key data types)
- backup full-text search
Accuracy of recovered data & its attributes, granularity of recovery options.
- offline data export in PST, EML and ZIP (for full accounts)
- non-destructive restore to the same / another user
- instant offline downloads (w/o requests & other delays)
Ability to configure & audit backup access permissions for administrators and end-users.
- audit log capturing all backup events (browse, export, etc)
- customizable admin roles, user backup self-service
Transparency of protection status and error reporting, availability & flexibility of API.
- email notifications for critical events
- web dashboard with domain-wide protection summary
System stability and extent it can function with little admin supervision and maintenance.
- >90% backup success rate, >2MB/sec backup speed
- no errors / failures during initial set up
Solution scalability to 10s of thousands of users, flexibility and simplicity of installation options.
- simple 1-30 min onboarding
- no need to have FTE to maintain backup infrastructure
Licensing model and total cost of the backup infrastructure and storage ownership.
- clear licensing model based on number of active users
- no additional charges for SharePoint, Groups or storage
Quick support resolution & response time, ticketing system and online knowledge base.
- <12h support response time, <1h for critical issues
- support provides relevant and helpful resolution options
Best O365 Backup Solutions
We believe that Veeam, Afi and Spanning have the best Office 365 backup solutions as of 2021.
Other products we reviewed offer less in terms of the backup scope, accuracy, reliability and backup management features. Relevant missing features in most solutions include (absent) support of Exchange public folders, no email archive backup and inadequate roles/access control settings.
|Success Rate||Market Share|
Veeam Office 365 Backup
Veeam has intuitive UI and wide range of supported O365 data sources, including Teams data sources (Chats, Channels and Teams Sites). It is also one of the only two Office 365 backup tools that provide full-text search capabilities for Exchange Online.
Veeam has the most complete O365 support, but the traditional software approach has limitations and hinders its adoption
Veeam solution is sold as traditional on-premise software. It needs to be installed on a Windows machine and be connected to a storage repository. This deployment model enables greater control but is often less desirable for organizations aiming to minimize the complexity associated with the need to maintain and manage server and storage infrastructure.
The Veeam (on-prem) software deployment model is not as scalable as cloud solutions, and when the number of O365 users exceeds around 4,000 it may be hard to use. The initial backup for an organization with 4,000 users and approx 80TB in M365 storage may take 3+ weeks, and the software will require a powerful [=expensive, with flash storage and lots of RAM] server to perform even regular incrmental backups afterwards.
To use all Veaam features you will need to install additional applications and libraries, including Veeam Explorer for SharePoint, Veeam Explorer for Exchange and Veeam Explorer for Microsoft OneDrive for Business (these are required for backup preview). To use indexed search for Exchange you will also need the Extensible Storage Engine library installed on your backup server.
Afi is the sponsor of this review. We will not provide a detailed product description in this blog post (see the product page if you're interested).
In short, we believe that Afi O365 backup is second only to Veeam; its unique features include integration with Azure AD (enabling protection management by O365 user groups), cloud-based full-text search and AI-powered anti-ransomware.
Spanning is #3 and it offers a Microsoft 365 cloud backup service with advanced features such as customer-managed encryption key, audit log and out-of-the-box integration with Kaseya RMM.
The solution showed strong backup/restore speed (3.5 MB/sec) in the test, with average reliability (95% success rate).
Spanning disadvantages include incomplete SharePoint backup support (web pages can't be restored correctly, document library files can't be exported offline) and partial Teams backup (only team sites are backed up, without Chats or Channel conversations).
Veeam Software Details
O365 Backup Fidelity
Veeam backs up all key O365 applications, including Exchange Online, SharePoint and OneDrive. It accurately retains data from all Exchange mailbox data types (Notes, Tasks, shared email folders and Skype conversation history).
The solution backs up Shared mailboxes (shown as separate resources in the domain list of users & Sites), as well as the Classic (legacy) SharePoint Sites.
Veeam provides full support of Teams backup, including Teams Sites, Channels and 1-1 Chats backup (restore back to M365 is unavailable due to M365 API limitations).
The system limitations include lack of support for OneDrive shared files (the files shared between O365 users are ignored when the recipient users are backed up), and incomplete support of Teams Lists – they are included in backups, but Veeam restores them as binary files that cannot be red by M365.
Veeam uses traditional backup schedules approach to manage backups. Admins need to configure the time and frequency of each backup schedule and specify which resources should be backed up. While this approach provides greater control over the backup process, it is no longer used in modern cloud Office 365 backups as it creates management complexity and overhead.
A newer SLA-based approach to backup management (used in Afi and some other modern Office 365 backup options) enables to set protection settings (backup frequency and type of resources that need to be protected) without the need to manage the exact time of backups.
The system lets you configure auto-protection for the entire domain. However, it will only work if you have enough spare licenses inventory purchased in advance.
Access Control & Audit
Veeam has more limited access control settings compared to any cloud Office 365 backup because of the limitations inherent in the on-premise deployment model (Veeam needs to be installed as a Windows app).
The system has no web-based management interface and in order to manage backup & recovery the administrators should remotely connect to the server where Veeam O365 backup is installed.
Veeam does not have configurable admin roles or permission settings, and access to backups can only be limited at the Windows sever level (all who have access to the machine will have equal access to backups).
Similarly to admin roles, Veeam has no user self-service capabilities because access management is not implemented at the level of the backup software.
Only a limited set of Veeam system events are logged, with no audit trail recorded for data preview & browsing operations or application access. The events that the system does log only identify the account used to sign in Windows, with no authentication implemented at the Veeam application level.
Search & Backup Preview
Veeam enables backup data preview for Exchange mailboxes as well as OneDrive and SharePoint sites backups. To use it you need to install three additional local software tools (Veeam Explorer for SharePoint, Veeam Explorer for Exchange and Veeam Explorer for Microsoft OneDrive for Business).
The system lets you compare backed up version with the current state of the mailbox (for example, to find deleted or moved items), which accelerates the recovery in many cases.
Unlike virtually all systems (except for Afi), Veeam enables full-text email search in backup data using the Extensible Storage Engine library that needs to be installed locally.
Restore & Data Export
Veeam restore works reliably (93 of 94 mailbox and OneDrive recovery attempts completed without errors).
Every restore operation requires a password (either O365 admin account or Azure application password depending on the authentication mode, see deployment details), which slows down the restore process.
Because the software is installed locally, it can only export data to the local Windows machine where Veeam is installed. Mailbox export in PST format requires MS Outlook installed on the server.
Reporting & API
There is no web-based reporting since Veeam only provides local UI, but you can generate protection status and backup job reports in PDF.
You can also connect Veeam O365 Backup to Veeam Backup and Replication (their flagman product) to get high level summary for backup and protection status, reported along with metrics for the rest of your on-premise infrastructure.
The system has REST API, as well as PowerShell command line interface, which enables scripting & automation (available locally; you need to set up PowerShell Remoting to enable execution of scripts remotely).
Veeam Office 365 backup solution has no email notification capabilities since it cannot connect to an SMTP server. Given that it is an on-premise system that requires monitoring and maintenance we believe that the email notifications are a must. One way to implement the notifications is to install Veeam Backup and Replication (VBR) separately (licensing cost is approx. $400 per year for Starter edition). You will then be able to connect Veeam O365 with VBR, which in turn can be connected to an SMTP server.
Performance & Reliability
Veeam backup speed and success rates are slightly above the averages. The backups are completed at 2.3 MB / sec, and the backup success rate averaged at 98% (the few errors that happened were due to network connectivity).
Upon the initial set up the discovery of SharePoint Sites took approx. 3 hours, which is an unusually long time for a domain with only 13 users and 5 Sites.
Without the Extensible Storage Engine library the search functionality works very slow even for small accounts (5+ minutes for a 3 GB mailbox).
Deployment & Maintenance
Veeam software must be downloaded and installed manually. The installation requires a physical machine or a VM with a Windows Server, in addition to a storage repositary (local or cloud). Veeam supports AWS S3, Azure Blob (only Premium, Hot and Cool options) - Archive tier is not supported, and other S3-compatible storage.
The system can be configured to store backups in multiple backup storage destinations. You will need to create multiple backup schedules and specify different backup storage locations (each backup schedule can store data in a single storage location).
In order to connect Veeam to O365 you will need to manually configure authentication and access permissions, which requires some technical expertise. In short, you should create a custom Azure application with an access certificate and then assign administrator access roles to the application O365. Veaam O365 backup will use this Azure application to securely connect to your O365 account. Alternatively, there is a less secure legacy connection option (you'll need to type O365 admin credentials in Veeam O365) which is easier to implement.
Licensing & Cost
Veeam licenses can be purchased in bundles of 10 . The price per one license is $18 annually (so the minimal purchase is $180). The software is free for less than 10 protected users.
One Veaam license is required for every O365 user and Shared mailbox. All users who have access to SharePoint Sites must be licensed to backup the Sites. This effectively means that you need to license all users in the domain in order to backup SharePoint Sites.
At $18 annual cost Veeam is 40% cheaper than most Office 365 cloud backup services (around average $30 annual license cost). However the total cost of a DIY Office 365 backup solution based on Veeam software will also include infrastructure costs and approx. 60% of a full-time employee (FTE) to monitor & maintain it.
|Cost Type||Number of units||Cost per unit||Total cost / year||Details|
|Backup software licenses
for 2,000 users
|Assuing 20% discount off of $19.2 MSRP|
|Cloud backup storage||42
for 42 TB of backup data
|Standard storage; erasure coding & multi-region replication will result in higher costs|
|Cloud ops & network||42
for 42 TB of backup data
|Assuing limited number of recoveries; heavy usage will result in higher costs|
|Backup server compute||8,760
for 1 VM to host backup server
|Higher user count will require a cluster of multiple backup servers|
|Management & maintenance overhead||60%
of an FTE
FTE's annual salary
|More IT admin time may be required depending on the number of user recovery requests (self-service recovery is unavailable)|
implied cost per user
total cost per domain
|Does not include some costs (Windows server licenses, anti-malware software)|
The total do-it-yourself solution based on Veeam software would therefore cost $42 per user per year cost. However, the reliability of the solution would likely be lower than most cloud backup services, since the set up does not account for geo-redundant backup storage, anti-malware protection, or highly-available backup server or auto-scaling.
With these economics, Veeam solution makes sense if you already have in-house IT team that is underutilized and the Veeam backup monitoring and management efforts will utilize spare capacity.
Afi Backup Details
Afi is the sponsor of the research. We will not assign the scores to avoid being too biased, but we will provide a short overview of the features.
O365 Backup Fidelity
Afi was developed from the ground-up to support Office 365, however it is still subject to Microsoft API limitations (or the absence of thereof for some M365 applications).
Afi Microsoft Teams support includes Channels messages (public AND private), Channel attachments, 1-1 chats, team wiki and team sites. Teams chats data can be backed up and available for online search, preview and export (in a convenient html/xml format), however the messaging data cannot be restored back to O365. Please check out this blog post if you want to learn more about Microsoft Teams Backup and related limitations.
Afi backs up modern and legacy SharePoint sites (unsupported by many vendors), as well as Shared mailboxes. One current limitation is backup of Exchnage online archive (the feature is planned to be rolled out in Nov 2020).
Afi is the only vendor that enables M365 user group-based backup management – you can use your Azure AD group structure to browse your resources and assign protection to existing or new users/sites/shared mailboxes.
Access Control & Audit
In addition to industry standard capabilities (support of 2FA, MS SSO), Afi has custom admin roles which help configure limited backup operator access (IT staff with permissions to restore data & manage backups, but not able to view backups contents). Afi can also be configured to limit M365 super admins' backup access.
Afi audit log captures all data preview, configuration and backup operations, in addition to session details (which includes WAN IP address).
Backup Search & Preview
Afi provides real-time backup data preview and instant export/downloads (no need to request export and wait until a download link is generated), all data can be exported instantly in Afi.
Deployment, performance and reliability
Afi is a relatively new platform; it was developed in 2016-2017 (5-10 years later than most solutions on the market). It was built from the ground-up for the cloud and is deployed as a distributed container-based application in GCP and AWS. With 5.8 MB/s backup speed Afi is 2-3x faster than other services.
O365 Backup Fidelity
In addition to the standard data sources (Exchange Online, OneDrive, SharePoint sites), Spanning offers partial backup of MS Teams (limited to Team Sites) and backup of Skype for Business Conversation History.
Spanning SharePoint Sites backup is limited in that it cannot recover page libraries correctly. Spanning resotres webpages as plain aspx files that cannot then be opened by O365 SharePoint. Teams Wiki pages backup is limited in the same way.
Microsoft Teams backup includes Team Sites backup, however team channels, 1-1 messaging, team calendar, OneNote and team shared mailboxes are not supported.
Spanning does not let administrators select backup frequency or create custom backup policies by selecting applications to be excluded or included in backups. It performs automated backups once a day (while the 3x daily backup frequency is a de-facto market standard).
O365 Groups cannot be used for policy assignment and backup configuration. Only per user protection settings are available, which may be a problem for domains with 100+ users.
Spanning does not have auto-protection settings for newly created users or sites.
Access Control & Audit
All Spanning admins have equal rights without the option to configure limited roles for IT help desk technicians or restore operators (having the privileges to restore user data without the ability to see the contents). Only administrators can execute backup & restore operations, with no user self-service option.
The system keeps a detailed audit log of backup operations.
Backup Search & Preview
Spanning provides metadata search for Exchange Online, Drive, SharePoint backups. OneDrive and SharePoint document libraries directory structures can be navigated in order to locate the required file/folder. The system has no online preview for emails, contacts or calendar events.
Restore & Data Export
File restore from user OneDrive to SharePoint Document Libraries (or the other way around) is not supported.
Spanning cannot restore correctly the SharePoint web pages. They are instead restored to Document Libraries as binary aspx files (which MS SharePoint online cannot read correctly). Spanning does not support offline data export for Calendar and SharePoint backups.
Reporting and API
Spanning provides an API for licenses management, as well as a pre-built integration with Kaseya RMM (which owns Spanning).
To track O365 protection status Administrators need to export and process system events log offline (the system does not provide a summary online.
Deployment & Maintenance
Spanning provides a 100% cloud-based service hosted in AWS. It offers 3 storage locations that can be selected upon sign up (US, Ireland and Australia).
One interesting capability that the system provides is the customer-managed certification keys for data encryption (via AWS key management). This is an advanced option that enables customers to take full responsibility over the backup encryption, and revoke Spanning application access to the backup data at any time. This introduces an additional data security layer (all other vendors manage the encryption keys of the behalf of their clients). It is typically used by large enterprises subject to special compliance requirements.
Licensing & Cost
One backup license is required for every O365 user or a Shared mailboxe. SharePoint backup is not licensed separately and can only be protected if 90% of users in the domain are licensed.
License management module is easy to use and straightforward, with options to license individual users or all domain users in a single click.
Performance & Reliability
Spanning application showed fast backup speed (3.2 MB/sec), with its backup success rate (94%) in line with the industry average.
In some cases the on-demand backup jobs manually initiated by administrators may start with significant delays, seemingly at a random time (it takes from 15 minutes to 24 hours for a backup to start).
Other Solutions & Final Thoughts
Eight other O365 backup solutions that we reviewed provide more limited feature sets and less complete Office 365 support.
SkyKick (#4 in the review) solution is focused on Office 365 backup resellers, featuring modern and fast UI. However it has the same O365 data types support limitations as Spanning, the system has no offline export capabilities and uses legacy authentication (adds security risks, and requires 5 additional O365 accounts). SkyKick restore operations are single-threaded (making them very slow) and it provides no customer access to backup management (only MSPs can use it on behalf of their clients).
Other vendors (#6-10) provide O365 backup support as part of their traditional backup software platforms, and their Office 365 backup feature sets are narrower. Many of them don't fully support Teams, Groups and SharePoint backup. At the same time these products are still useful if you need Exchange Online or OneDrive backup solution.
Please check our other blog post if you'd like to get more detailed solutions comparison for SharePoint online backup.
All product names are trademarks or registered trademarks of their respective holders; use of them does not imply any affiliation with or endorsement by them.